ASA--常见应用配置

实验网络结构图：
DNS Server--------(outside)ASA-Firewall(inside)-------LAN Client
       |
    DMZ-WEB-Server
---------------------------------------------------
IP地址分配
外网：210.10.10.0/30
内网：192.168.210.0/24
DMZ： 192.168.202.0/24
----------------------------------------------------
ASA基本配置：
配置主机名、域名和密码
配置接口
配置路由
配置远程管理接入
为出站流量配置网络地址转换
配置ACL

enable
conf t
hostname ASA5520
domain-name lpq.com
enable password ASA5520
passwd cisco

conf t
interface e0/0
nameif outside
security-level 0
ip address 210.10.10.2 255.255.255.0
no shutdown
exit

interface e0/1
nameif inside
security-level 100
ip address 192.168.201.1 255.255.255.0
no shutdown
exit

interface e0/2
nameif dmz
security-level 50
ip address 192.168.202.1 255.255.255.0
no shutdown
exit

route outside 0.0.0.0 0.0.0.0 210.10.10.1
end
show route

conf t
telnet 192.168.201.0 255.255.255.0 inside
telnet timeout 15

crypto key generate rsa modulus 1024
ssh 192.168.201.0 255.255.255.0 inside
ssh 0 0 outside
ssh timeout 30
ssh version 2
username ASA5520 password cisco
aaa authertication ssh console LOCAL
passwd aaa

http server enable 8008
http 192.168.201.0 255.255.255.0 inside
http 0 0 outside
http 0 0 inside
asdm p_w_picpath disk0:/asdm-615.bin
username admin password admin privilege 15
----------------------------------------------------------------

access-list 111 extended permit icmp any any
access-list 111 permit ip any any

access-group 111 in inter outside
access-group 111 in inter inside
access-group 111 in inter dmz

access-list testacl deny ip 192.168.201.33 255.255.255.255 any
access-list testacl permit ip any any

access-group testacl in inter inside
--------------------------------------------
nat-control
nat (inside) 1 0 0
global (outside) 1 interface
global (dmz) 1 192.168.202.100-192.168.202.110

static (dmz,outside) 210.10.10.10.2 192.168.202.2
access-list out_to_dmz permit tcp any host 210.10.10.2 eq 80
access-group out_to_dmz in interface outside

end
write memory
copy running-config startup-config

清除配置信息：
conf t
clear configure all
clear configure comman [level2 command]
end
===========================================
ASA的高级应用-URL过滤

conf t
access-list tcp_filter1 permit tcp 192.168.201.0 255.255.255.240 any eq www

class-map tcp_filter_class1
match access-list tcp_filter1
exit

regex url1 \.sina\.com

class-map type regex match-any url_class1
match regex url1
exit

class-map type inspect http http_url_class1
match not request header host regex class url_class1
exit

policy-map type inspect http http_url_policy1
class http_url_class1
drop-connection log
exit
exit

policy-map inside_http_url_policy
class tcp_filter_class1
inspect http http_url_policy1
exit
exit

service-policy inside_http_url_policy interface inside //完整配置时删除此行
----------------

access-list tcp_filter2 permit tcp any any eq www

class-map tcp_filter_class2
match access-list tcp_filter2
exit

regex url2 \.game\.com
class-map type regex match-any url_class2
match regex url2
exit

class-map type inspect http http_url_class2
match request header host regex class url_class2
exit

policy-map type inspect http http_url_policy2
class http_url_class2
drop-connection log
exit
exit

policy-map inside_http_url_policy
class tcp_filter_class2
inspect http http_url_policy2
exit
exit

service-policy inside_http_url_policy interface inside

---------------------------------------